Unsafe Dependency Resolution Affecting black package, versions [,26.10.1)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-BLACK-21431452
- published22 Oct 2026
- disclosed22 Oct 2026
- creditJitesh Gulati
Introduced: 22 Oct 2026
NewCVE-2026-114134 (opens in a new tab)How to fix?
Upgrade black to version 26.10.1 or higher.
Overview
Affected versions of this package are vulnerable to Unsafe Dependency Resolution via insufficient validation of the required-version field in action/main.py. When the required-version key in pyproject.toml is set to a value that resembles a direct reference (e.g., a VCS URL or a local path), the GitHub Action passes it unsanitized to the package installer, allowing an attacker with write access to the pyproject.toml to cause the Action to install an arbitrary package in place of black.